Enterprise-class computer servers are becoming increasingly sophisticated and complex, which poses a greater need to monitor system health, and prevent unintended system interruptions. Traditionally, system administrators log system activity, and use this knowledge to estimate system health. However, this approach is not as useful in fast-changing environments, which may include application servers and virtual machines. These are the areas that embodiments of the invention are intended to address.